CVE-2026-5751

Name of the Vulnerable Software and Affected Versions justhtml versions prior to 1.14.0

Description A mutation cross-site scripting (mXSS) issue occurs when using a custom SanitizationPolicy that preserves foreign namespaces, such as setting drop foreign namespaces=False while allowlisting SVG/MathML elements or raw-text containers like <style>. This parser-differential flaw allows specially crafted input to be sanitized into markup that seems safe but becomes unsafe upon re-parsing by a browser or another HTML parser, leading to markup injection. The default safe configuration sanitize=True is not affected.

Recommendations Update to version 1.14.0. As a temporary mitigation, avoid setting drop foreign namespaces=False within the SanitizationPolicy.